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[57] ABSTRACT 

A system and method for preventing a copy of a document 
to the oulput from a printing node until the printing node 
authenticates the intended redoient . The system includes a 
sending node, a printing node and a communication link 
coupling these nodes together in a network fashion. The 
sending node has access to a public key of the printing node 
and uses this public key to enaypt a header and document 
before transmission to the printing node over the commu- 
nicatioQ Unk. The priority node has access to its private key 
to decrypt the header to ascertain whether the document 
requires authentication by the intended recipient before 
being output. 

24 Claims, 4 Drawing Sheets 
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APPARATUS AND METHOD FOR 
PREVENTING DISCLOSURE THROUGH 
USER-AUTHENTICATION AT A PRINTING 
NODE 

CROSS-REFERENCES TO RELATED 
APPIICAnONS 

One of the aamed inventors of the present application has 
filed U.S. patent applications entitled "Apparatus and 
Method for Providing Secured Conanunications", applica- 
tion Ser. No. 08/251.486, filed May 31> 1994. now U.S. Pat 
No. 5,539,828; **Roving Software License for a Hardware 
Agent", application Ser. No. 08/303,084, filed Sep. 7, 
1994now U.S. Pat No. 5,473,692; and 'Method for Provide 
ing a Roving Software License in a Hardware Agent-Based 
System", application Ser. No. 08/472,951, filed Jun.7, 1995, 
now U.S. Pat. No. 5 »5 68,552. These applications are owned 
by the same assignee of the present Application. 

BACKGROUND OF THE INVENTION 

1. Field of the Invention 

The present invention relates to the field of data security. 
More particularity, the present invention relates to a system 
and method for preventing a printing node from oiitputting 
confidential information until confirmation that an autho- 
rized recipient of the confidential information is proximate 
to the printing node. 

2. Description of Art Related to the Invention 

With the continual emergence of smaller, faster and more 
powerful computers, many businesses are currently in^le- 
menting "distributed** networks (e.g., local area networks 
and the like). These networks are advantageous in that ead) 
user has control over his or her own personal computer. 
Moreover, for economic reasons, multiple users can be 
connected to less frequently used hardware equipment such 
as printing nodes located in a public area accessible to all 
users. For the scope of this application, a "printing node" is 
defined as a stand-alone hardware device which can receive, 
tenqx)rarily store, and print or otherwise display data from 
a personal computer or any other transmission device. For 
example, a printing node may be represented as a printer, a 
printer operating in combination with a print sarver, a 
facsimile machine, a plotter, a remote monitor and the hke. 

A frequent problem experienced by distributed networks 
involves protecting confidential or proprietary information 
within documents (ha*einaftcr referred to as "sensitive" 
documents) from being mistakenly or intentionally read by 
unauthorized persons. Since the printing node is positioned 
in a public area, upon transmission of a print job to the 
printing node, the sender must immediately walk or run over 
to the printing node to pick up the sensitive document in 
order to protect the confidentiality of the information con- 
tained therein. In the event that the printing node is expe- 
riencing a temporary problem (e.g., jammed, out of paper, 
low on toner, etc.) or is queued with other print jobs, the 
sender must wait at the printing node for the fs-oblem to be 
corrected or for the print job to be performed. 

Alternatively, if available, the sender could return to his or 
her computer and cancel the print job associated with the 
sensitive document But, of course, there is a risk that the 
document will be printed or displayed during the sender's 
return to his or her computer. However, if the print job is 
mistakenly sent to a different printing node, perhaps an 
off-site printing node, there are relatively few available 
options to protect the sensitive document from being printed 
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or displayed and possibly read by an unauthorized individual 
if the sending ciror is detected after the print Job has begun. 

Regardless of whether print jobs may or may not be 
canceled, for distributed networks, persons waste valuable 
5 work time waiting around the printing nodes for sensitive 
documents. Such waste adversely affects the productivity of 
the sender and his or her company. 

Another problem experienced by distributed networks is 
protecting confidential information in sensitive documents 
from public view when printed for another person (e.g., a 
co-worker) at another site. Of course, the sensitive document 
could be electronically mailed to die co-worker in an 
encrypted format Sometimes, however, it may be undesir- 
able to electronically send a sensitive document because of 
&e possibility that it could be altered and/or electronically 
forwarded to unintended recipients. Of course, the document 
could be printed and mailed to the co-worker but there exist 
obvious disadvantages such as time delay, mail security, etc. 
Thus, it would also be advantageous to create a system and 
method which eliminates the inefficiencies associated with 
protecting sensitive information printed from a printing node 
intended for the sender or another intended recipient. 

SUMMARY OF THE INVENnON 

25 

The present invention relates to a system and method for 
preventing a copy of a document from being output (printed, 
displayed, etc.) by a printing node until die printing node 
locally authenticates the intended recipient The system 

30 includes a sending node, a printing node and a communi- 
cation link coupling these nodes together in a network 
fashion. The sending node has access to a public key of the 
printing node and uses this public key to encrypt a header 
and document before transmission to the printing node over 

35 the communication link. The printing node has access to its 
private key to decrypt the header to ascertain whether the 
document is "sensitive" (ie., requires recipient authentica- 
tion befwe priority). If so, the printing node locally buffers 
the document until it receives authorization to output the 

40 document 

BRIEF DESCaUPnON OF THE DRAWINGS 

The features and advantages of the present invention will 
become apparent from the following detailed description of 
45 the present invention in which: 

FIG. I is a simplified block diagram of a distributed, 
secure network system comprising a sending node and a 
printing node. 

FIGS. 2a and 2b are block diagrams of a network system 
using different verification methods concerning the public 
key of the printing node and both transferring an encrypted 
header and document from the sending node to die printing 
node. 

55 FIG. 3 is a flowchart illustrating the method for ensuring 
that a sensitive document tagged as containing confidential 
information will not be ou^ut until the recipient is present 

DESCRIPnON OF THE PREFERRED 
EMBODIMENT 

60 

The present invention relates to an apparatus and method 
for preventing the printing of a sensitive document at a 
printing node until the intended recipient authorizes such 
printing to occur. Although numerous details are set forth in 
63 order to provide a thorough understanding of the present 
invention, it is apparent to a person of ordinary skill in die 
art that the present invention may be practiced through many 
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different embodiments in addition to &at embodiment illus- element 235 of the sending node 110, the PNCert 215 may 

trated without deviating from the spirit and scope of the also be stored in the non-volatile storage element 235. Such 

present invention. In other instances, well-known circuits, storage is optional because PNCert 215 would not be needed 

elements and the like are not set forth in detail in order to again unless PUK 210 is corrupted or accidentally removed 

avoid unnecessarily obscuring the present invention. 5 from sending node 110. 

In the detailed description, a number of cryptography- After connecting the printing node to a network and 
related terms are frequently used to describe certain char- distributing PNCert 215 to the sending node 110 coupled to 
acteristics or qualities which is defined herein. A "key" is an the network, the sending node 110 can use PNCert 215 to 
encoding and/or decoding parameter for a conventional verify (i) the authenticity of the printer node's public key 
cryptographic algorithm. More specifically, the key is a jQ (**PUK") at its initial distribution and (ii) the characteristics 
sequential distribution ("string") of binary data being "n" of the printing node (i.e., whether it is able to enforce 
bits in length, where "n" is an arbitrary number. A "docu- recipient authentication procedures). Such verification may 
mcnt** is generally defined as a predetermined amount of be accomplished by a local trusted authority 230 (e.g., a 
data such as one or more pages of data being transferred in system administrator or security office of an entity owning 
a sequence of bus cycles. A "digital certificate" is defined as the printing node) issuing a verification certificate (**VCert*0 
a set of any digital information cryptographically bound 240 being the public key of the manufacturer (*TUKM") 
together through use of a private key by a widely known 227 encrypted with the private key of the local trusted 
trusted authority (e.g., bank, governmental entity, trade authority ("PRKLTA") 231. The public key of the local 
association, equipment manufacturer, company security, trusted authority ('PUKITA**) 232 would be widely avail- 
system administration, etc.). A "digital signature" is a simi- 20 ^^^^ ^ ^^ers of the network. The verification cotificate 
lar tedinique used to assure integrity of a message, using the 240 may be decrypted to obtain PUKM 207 which can be 
private key of the message originator. used to obtain PUK 210 by decrypting PNCert 215. 

Referring to FIG. 1. a simplified version of a distributed. Another example of a method which can obtain as well as 

secure network system configured to prevent sensitive docu- verify PUK is shown in FIG. 2b in which the local trusted 

mcnts from being mistakenly printed is shown. The secure 25 authority 230 internally certifies PUK 210 before providing 

network system 100 includes at least one sending node 110 it to the sending node 110. As shown, the local trusted 

coupled through communication lines 120 to a printing node auttiority 230 obtains PUK 210 from the printing node 130 

130. Although not shown, more than one sending node could by dec^ting PNCert 215 using the public key of the 

be coupled to the printing node 130 through shared or printing node manufacturer **PUKM" 227. Thereafter, the 

independent communication similar to lines 120. As secure 30 local trusted authority 230 creates a locally generated vcri- 

network systenos gain greater conomercial acceptance, a fication certificate (**LVCert") 245 and sends LVCert 245 to 

document will generally be encrypted within the sending the sending node 110. Similar to PNCwt of FIG. 2a, LVCert 

node 110 before it is placed on the communication line(s) 245 may be stored in the non-volatile storage element 235 

120. This will protect against an interloper gaining access to after verification of PUK 210 if desired. The sending node 

the confidential information as it is transmitted to the 35 110 decrypts LVCert 245 using PUKLTA 231 which is 

printing node 130. Thus, the printing node 130 preferably widely available. As a result, the sending node 110 obtains 

includes software or hardware, such as disclosed in the PUK 210 which is subsequently stored in the non-volatile 

above cited cross-referenced applications, to decrypt the storage element 235. 

document before outputting. As shown in both FIGS. 2a and 2h, after the public key 

Referring now to FIGS. 2a-2b, illustrative embodiments 40 "PUK* 210 of the priority node 130 is available to the 

of the network system using an asymmetric key technique sending node 110, the sending node 110 can encrypt a 

adopted by the sending and printing nodes 110 and 130 are document 250 under an asymmetric "Rivest Shamir Adle- 

shown. This asymmetric technique uses two separate keys mann" (*'RSA") algorithm using PUK 210. This forms an 

(referred to as a "public key" and "private key") for encryp- encrypted document 255 to be transmitted to the printing 

tion and decryption purposes. To establish unidirectional 45 node 130. Additionally, a header 260 for the document is 

communications from the sending node 110 to the printing encrypted using the public key "PUK" 210 of the targeted 

node 130. the public key of a printing node (**PUK") should printing node 130 producing an encrypted header 265. As an 

be initially accessible to the sending node 110 through any alt^native to RSA encryption of the print job, '*hcadcr" may 

one of several verification methods such as through a contain a "session key" that is then used by both the send^ 

network-based printer-key server, through an initialization 50 and receiver to perform the required cryptographic opcra- 

of all network nodes with relevant printer public keys as they tions on the document It is well-known that a *Tieader'' is a 

arc added to the network, or through any other conceivable common technique to reduce the computational perfor- 

method. Each of these possible methods may use one or mance normally associated with public key cryptography, 

more digital certificates issued by at least one trusted author- especially for large data sets. However, for this invention, 

ity to obtain PUK and substantiate its authenticity of the 55 the header 260 includes control information which allows 

printer node. the printing node 130 to support various functions. 

One method of obtaining and verifying PUK is shown in For example, the header 260 may include control infor- 

FIG. 2a. A trusted authority such as a printing node manu- mation indicating that the document is a "sensitive" docu- 

facturcr 225 produces the printing node 130 having a public ment by selecting the document to have a certain "confi- 

key ("PUK') 210 and a private key ("PRK*) 211 within a 60 dentiality*' level diereby requiring on-site authentication of 

non-volatile storage element 205 implemented within the the intended recipient before printing if the confidentiality 

printing node 130, In addition, the manufacturer 225 stores level exceeds a predetermined (or normal) levcL Another 

a printing node certificate (**PNCert") 215 within the non- example is for the header 260 to include a public key of the 

volatile storage clement 205. The printing node certificate intended recipient of a printed copy of sensitive document 

PNCert 215 is equivalent to at least PUK 210 encrypted with 65 Thus, before printing the "sensitive" document, the printing 

a private key ("PRKM") 226 of the manufacturer 225. After node 130 would confirm that the recipient is present through 

verification and storage of PUK in a non-volatile storage one of a number of authentication techniques (discussed 
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below) using the public key of the intended recipient A for facility security (e.g., buildings, rooms, etc.). Biometrics 

further example is that the control informatioa may include involves sensing a characteristic of the user (e.g., finger 

tag information such as a **print only** tag. This tag would print, iris, retina, etc.) to capture a single frame of data 

allow the "sensitive" document 250 to be printed from the (generally referred to as "data frame") or more likely mul- 

printing node 130 but would not allow the document 250 to 5 ^^P^^ frames of the characteristic and comparing the 

be stored in its text format in memory. A logical extension captured data frames widi a previously stored master. If each 

of this **print only" tag is the control information including captured data frames coinpare correcdy to the stored 

a parameter which indicates the number of times the "sen- ^^"^^ authenticated, 

sitive" document could be printed. Referring now to FIG. 3, a flowchart illustrating the 

. J ^ , * in operations of the network system are shown. First, the 

In a preferred embodiment a print job bemg a concat- lo ^^^^^^ ^^^^ ^ .^^^^ ^ "sensitive" document or a 

cnatioD of the encrypted header 265 and the encrypted normal document depending on whether confidential and/or 
document 255 is transferred through a pubUc domain 270 proprietary information is contained in the document (Step 
and into the printing node 130. The printing node 130 first ^OO). H a normal document, upon transmitting the document 
decrypts the encrypted header 265 using PRK 211 to ascer- ^ printing node, the sending node creates a header 
tain whether the encrypted document 255 contains confi- 15 i^^^u^jg disclosure protection information such as ''print- 
dentialinformationrequiringthcprinting node 130 to refrain ^nly" tags which restrict the document to only be printed, 
from at least printing the document 250 untQ the intended mitigating any chances to modify the document (Steps 
recipient is present at the printing node 130. Thus, the 305-310). Thereafter, the header and document are 
document 250 is temporarily stored in buffer memory (not encrypted before being transmitted to the printing node, 
shown) within the printing node 130 preferably, hut not 20 ^^^^^^ ^ document is "sensitive", upon transmit- 
necessarily, in its encrypted format. Upon receiving confir- ^ document to a printing node, the sending node 
mation that the intended recipient is present the encrypted ^ including information necessary to authen- 
documcnt 250 is (i) retrieved from the buffer memory, (ii) ^^^^ ^^^^ ^^^^^^^^ (p^^^Uc key, tokens and the like) 
decrypted, and (m) prmted. information needed for additional disclosure pro- 
It is conten^lated that there may exist conditions when tection (Steps 305, 315). If the authentication information is 
the document is not retrieved or the buffer memory becomes a release code, the release code must be displayed on a 
full. In these and other related conditions, it may be neces- display monitor of the sending node to enable the intended 
sary to **flush" (i.e., delete from memory) certain unreuieved recipient to instruct the printing node to begin printing the 
documents from the buffer memory thereby freeing up sensitive document (Step 320 and 325). Thereafter, the 
memory space. This may be performed automatically header and document are encrypted forming a print job and 
through software and/or hardware or manually by a system the print job is transmitted to the printing node (Step 330). 
administrator, users of the network and the like. yp^j^ receiving the print job, the printing node decrypts 
There are a number of authentication techniques to con- the header to determine whether the document is a "sensitive 
firm that the intended recipient is present at the priating document" (Step 335 and 340), If the document is a normal 
node. One technique is to await a personal identification document, the printing node decrypts the document (Step 
number ('TIN*') of the intended recipient to be entered 355) and subsequently prints the document (Step 360). 
through a keyboard and number pad on the printing node However, if a sensitive document, the printing node stores 
before starting a print job of a sensitive docimient In this the encrypted document in an internal buffer memory (Step 
case, the printing node may contain memory storing PINs ^ 345) and awaits authentication by the intended recipient that 
associated with each recognized public key or the PIN may he or she is near the printing node (Step 350). Upon 
be transmitted to the printing node throu^ the header. receiving authentication through providing a PIN, release 
Another technique is to enter a ^"release code" through the code, an authentication token and the like, the printing node 
keyboard. The release code is job-specific being generated decrypts the document and thereafter prints the document 
by the sending node at print-time and included in the header. 45 (Steps 355 and 360). It is contemplated diat the sensitive 
The release code is displayed on the display monitor of the document may be decrypted prior to Step 345 so that once 
computer for a brief period of time to provide the user theiatendedrec^)ient is identified, the sensitive document is 
sufficient information to retrieve the print job. If the intended queued for printing and printed (Step 360). 
redpieat is not the sending user, the sending user may The invention described herein may be designed in many 
communicate the release code through a telephone call, 5Q different methods and using many different configurations, 
electronic mail, or any other means to the intended recipient While the present invention has been described in terms of 
Yet another technique is to use some type of authenticat- various embodiments, other embodiments may conoe to 
ing token such as a PCMCIA identifier card or smart card mind to those sMUed in the art without departing firom the 
which can be inserted into the printing node. Instead of spirit and scope of the present invention. The invention 
requiring the printing node to mflftitain a record of token 55 should, therefore, be measured in terms of the claims which 
identifications, the public key of tiie token would be follows, 
included in the header and transmitted to the printing node What is claimed is: 

preferably in an encrypted format Thus, the printing node 1. A method for preventing a printing node from output- 
would need to sixthly match the pubUc key of the token to ting a copy of a document until an intended recipient of the 
the pubUc key previously received in the header of the print 50 document is authenticated, the method comprising the steps 
job and execute a standard challenge/response protocol with of: 

the token. Such a challenge/response protocol ensures that selecting a confidentiality level for a print job including 

the token is authentic by proving the token is in possession the doomient, said confidentiality level is selected to be 

of the private key corresponding to the hcadcr-spcdfied equal to at least a predetermined level when the docu- 

public key. 55 ment contains sensitive information; 

A fourth technique is to utilize an access control technique creating a header for said print job, said header being a 

called **biometrics" which uses a capturing device primiarily first header when said confidentiality level is equal to at 
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least the predetennined levels said first header includ- 
ing at least (i) infomiation used to authenticate the 
intended recipient^ and (ii) control information includ- 
ing at least said confidentiality level; 
transmitting said pdnt job to the printing node; 
analyzing said header by the printing node; and 
outputting the document once the intended recipient is 
authenticated, and thus, is physically proximate to the 
printing node. 

2. The method according to claim 1. wherein said header 
created by said creating step being a second header when 
said confidentiality level is selected to be less than said 
predetermined level said second header consists of control 
information. 

3. The method according to claim 2, wherein prior to said 
transmitting step, the method further includes the step of 
encrypting said header with a public key of the printing 
node. 

4. The method according to claim 3, wherein prior to said 
transmitting step, the method further includes the step of 
encrypting the document with said public key of the printing 
node. 

5. The method according to daim 3, wherein said ana- 
lyzing step includes the step of decrypting said header with 
a private key of the printing node to determine said confi- 
dentiality level. 

6. The method according to claim 5, wherein said ana- 
lyzing step further includes the step of 

buffering the document in a format encrypted by said 
public key of the printing node when the confidentiality 
level is at least equal to the p-edetermined level 

7. The method according to claim 1, wherein the output- 
ting step includes the step of decrypting the document with 
a private key of the printing node upon completing authen- 
tication of the intended recipient. 

8. The method according to claim 7, wherein the output- 
ting step further includes the step of printing the document 

9. The method according to claim 1, wherein the intended 
recipient is authenticated by performing one of a plurality of 
authentication techniques including (i) inputting a personal 
identification number into the printing node, (ii) inputting a 
release code into the printing node, and (iii) inserting an 
authenticating token into the printing node. 

10. The method according to claim 1, wherein the 
intended recipient is authenticated by a capturing device of 
the printing node obtaining biometric data of the intended 
recipient and comparing the biometric data to a pre-storcd 
data. 

11. A method for preventing a printing node from output- 
ting a copy of a document associated with a print job until 
an intended recipient of the document is authenticated, the 
method comprising the steps of: 

creating a first header for said print job, said first header 
including at least (i) information used to authenticate 
the intended recipient and (ii) control information 
including at least a confidentiality level to indicate 
whether the document contains sensitive information; 

encrypting said first header and the document of said print 
job with a public key of the printing node; 

transmitting said print job to the printing node; 

storing the encrypted document in the printing node; and 

decrypting the encrypted document and queuing the docu- 
ment to be output once the intended recipient has been 
authenticated to signify that the intended rec^)ient is 
physically proximate to the printing node. 

12. The method according to claim 11, wherein said 
control information of said header includes a public key of 
the intended recipient 
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13. The method according to claim 11, wherein said 
control information further includes a print-only tag. 

14. The method according to claim 11, wherein said 
control information further includes a parameter indicating 
a number of times the document can be output 

15. A method for preventing a printing node fi"om out- 
putting a copy of a document associated with a print job until 
an intended recipient of the document is determined to be 
physically proximate to the printing node, the method com- 
prising the steps of: 

selecting a confidentiality level for the print job; 

creating a header for said print job, wherein 
if said confidentiality level is at least equal to a prede- 
termined level, said header being a first header 
including at least (i) infomiation to authenticate the 
intended recipient, and (ii) a first set of control 
information including at least said confidentiality 
level and 

if said confidentiality level is less than said predeter- 
mined level said header being a second header 
including a second set of control information; 
encrypting said print job; 

transmitting said print job to the printing node; and 
decrypting said header to obtain the confidentiality level, 
wherein 

if the confidentiality level is at least equal to said 
predetennined level 

temporarily storing the document, and 

outputting the document once the intended recipient is 
authenticated and physically proximate to the print- 
ing node, and 

if the confidentiality level is less than said predetennined 
level, 

preparing the document to be output by the printing 
node. 

16. A system that prevents a copy of a document from 
being output firom a printing node until the printing node 
receives local authentication from an intended recipient of 
the document, the system comprising: 

a communication link; 

a sending node coupled to said conmiunication link, said 
sending node includes a storage element which con- 
tains at least a public key associated with the printing 
node, said sending node utilizes said public key to 
encrypt both a header of the document and the docu- 
ment prior to transmission to the printing node via said 
communication link; and 

the printing node coupled to said communication link, the 
printing node includes a storage element which con- 
tains at least a private key associated with the printing 
node, the printing node decrypts said header to obtain 
a confidentiality level of the document and prevents the 
document firom being output until authentication that 
the recipient is physically proximate to the printing 
node when the confidentiality level exceeds a prede- 
termined level 

17. Hie system according to claim 16, wherein said 
sending node is a computer. 

18. The system according to claim 16, wherein said 
printing node is one of a printer, a plotter, a facsimile 
machine and a display monitor. 

19. The system according to claim 16, wherein both said 
storage dement of said sending node and said storage 
element of said printing node are non-volatile memory. 

20. The system according to claim 16. wherein said 
storage clement of said printing node further contains a 
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digital certificate being at least said public key of the 
printing node encrypted with a private key of a trusted 
authority. 

21. The system according to claim 16, wherein said 
printing node includes internal memory to store the docu- s 
ment until the intended recipient is authenticated, and thus, 
physically proximate to the printing node. 

22. A system that either immediately queues a non- 
confidential document to be ou^ut from a printing means or 
prevent a copy of a confidential document from being output lo 
from the printing means, the system con^rising: 

sending means for encrypting a print job having a first 
header and the confidential document with a public key 
of the printing node and for transmitting the encrypted 
first header and encrypted confidential document to the 
printing means, said sending means includes a first 
storage means for containing at least said public key; 

printing means for decrypting said first header, analyzing 
said first header to detennine that said print job con- 
tains the encrypted confidential document and for pre- 



venting the confidential document from being printed 
until authentication that an intended recipient is physi- 
cally proximate to the printing means; and 
means for communicating between said sending means 
and said printing means. 

23. The system according to claim 22, wherein said 
sending means fiirther encrypts another print job having a 
second header and the non-confidential document with said 
public key of the printing node and transmits the encrypted 
second header and encrypted non-confidential document to 
said printing means. 

24. The system according to claim 23, wherein the print- 
ing means further decrypts said second header thereby 
determining that said another print job has the non- 
confidential document and prepares the non-confidential 
document to be output without authentication of the recipi- 
ent 
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